MC1429019 High
Microsoft SharePoint Online: Restricted access control for sites enforced across Microsoft 365 search
Summary AI-generated
Restricted Access Control (RAC) policies will now be enforced across Microsoft 365 search, ensuring users only see permitted SharePoint and OneDrive content in search results.
Suggested actions AI-generated
- Review RAC configurations and group memberships for SharePoint and OneDrive sites
- Inform helpdesk and support teams about search result changes
- Update internal documentation on search behavior and access
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1274323 SharePoint Advanced Management: Delegate management of Restricted Access Control (RAC) to site admins
- MC1395311 Microsoft SharePoint Online: Retirement of Restricted SharePoint Search
- MC1259825 SharePoint Advanced Management: Site admin control for restricted content discovery
- MC1427972 (Updated) Microsoft SharePoint: Restricted content discovery enhancements for Copilot and Microsoft 365 search
- MC1197128 New permissions report available in SharePoint admin center
- MC1192256 Microsoft Purview | Data Loss Prevention- Admin units support for Microsoft SharePoint Online
Original post from Microsoft
[What and Why]
We are enhancing how Restricted Access Control (RAC) for sites is enforced across Microsoft 365 search by extending RAC policy enforcement to Microsoft 365 search, including SharePoint search, organization-wide search, and Microsoft 365 app experiences such as Office.com.
RAC limits access to SharePoint and OneDrive sites that have RAC enabled to specific groups. With this update, users will only see search results for content they are permitted to access based on RAC policies, improving data security and ensuring consistency between access controls and content discovery.
This update applies to both existing and new RAC-enabled SharePoint sites and OneDrive accounts.
[Rollout Schedule]
General Availability (Worldwide, GCC High, DoD): Rollout is expected to begin in late July 2026 and complete by late July 2026.
[Impact on Your Organization]
Who is affected
- Admins managing SharePoint Online and OneDrive site access
- All users in organizations with RAC-enabled sites
Platforms/Services
- SharePoint Online
- OneDrive
- Microsoft 365 search (including SharePoint search, organization-wide search, and Microsoft 365 app experiences)
What will happen
- RAC policies for sites will be enforced in Microsoft 365 search results.
- This applies to both SharePoint sites and OneDrive accounts with RAC enabled.
- This change applies to existing and new sites where RAC is applied.
- This change is applied automatically as part of the service update.
- There is no change to how RAC policies are configured.
[Action Required/Recommendations]
No action is required to receive this update. However, you may consider the following:
- Review RAC configurations and associated group memberships for SharePoint and OneDrive sites.
- Inform helpdesk and support teams about changes to search result visibility.
- Update internal documentation that references search behavior and access expectations.
Learn more: Documentation will be updated closer to broad rollout (~90% completion).
- Restrict OneDrive access by security group | SharePoint in Microsoft 365 | SharePoint | Microsoft Learn
- Restrict SharePoint site access with Microsoft 365 groups and Microsoft Entra security groups | SharePoint in Microsoft 365 | SharePoint | Microsoft Learn
[Compliance considerations]
| Question | Answer |
| Does the change alter how existing customer data is processed, stored, or accessed (for example, documents, emails, chats)? | Yes. This update changes how existing content is surfaced in search results by enforcing existing permissions (RAC policies). |
Additional details from Microsoft
- Summary
- Restricted Access Control (RAC) for SharePoint and OneDrive sites will be enforced across Microsoft 365 search, limiting search results to content users can access. This update, rolling out in late July 2026, applies automatically to existing and new RAC-enabled sites without changing RAC configurations.